---
typeId: req
recordId: benac-pkg-004
fields:
  title: Package names are non-authoritative
  statement: >-
    Package names, versions, aliases, URLs, provider names, model names, product names,
    library names, repository names, labels, and human-readable descriptions shall not
    be used as package identity, authority, trust, approval, capability, artifact
    availability, or invocation eligibility.

    Invocation records shall identify package CID, invoked package interface,
    descriptor snapshot CID or descriptor scope where relevant, request snapshot CID,
    output snapshot CID where relevant, invocation contract snapshot CID where relevant,
    capability grants relied upon, evidence records, and effect records.

    A human-readable name shall not replace package CID or schema-bound invocation
    context.
  rationale: >-
    Names can collide, mutate, or mislead. Package identity and invocation authority
    require content identity, schema-bound context, and explicit Local Policy records.
  verification: >-
    Two packages with the same name have different package CIDs and are treated
    distinctly. Changing a package name does not change a capability grant or approval
    unless the package document content changes and produces a new package CID.
  testable: true
  status: draft
  area: BENAC-PKG
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Package model, descriptors, and package claims
  order: 78
---
